Security hole: only the first 8 characters in password matter

However, we seem to be entering an age of "ethical security". As computers and software become more powerful and complex, people expect every system that is "secure" to be "absolutely secure", at least up to some fuzzy isomorphism inside different "security classes".

What this leads to is thinking like: "if your website offers to protect my account with a password, it should be as secure as the most secure example of password-protected systems (passwords stored as hashes, strong password requirements, and so on)."

You can see this as well in the emerging (and somewhat stagnant) market of commodity biometric security devices, such as off-the-shelf fingerprint readers. There was a lot of talk about how they could be defeated by lifting your prints, taking impressions of your hand, and so forth. Essentially, the argument was "if you're going to offer biometric security, I expect it to be on par with NSA-class biometric security".

I'm not going to make a judgment as to whether this is the right approach, or not, but I suspect it is beneficial in the long run, even if unesseccarily expensive and overkill at any one point or example.